[Snort-users] Re: hmm...nimda RICHED20.DLL alarms

Ryan Drogo rydrogo at ...4382...
Tue Jan 22 06:54:14 EST 2002

I've seen this also, and it seems to be to be happening
whenever users log on to a win2k domain. The file is
coming from some deep subdirectory of the users'
profile directory, as some part of the office 2000 settings.
I'm not sure why this file gets moved, but it does. hope
that helps somewhat.

Ryan Drogo
System Administrator
UCSD Bioengineering
It is not enough to have a good mind;
the main thing is to apply it well.
  -- René Descartes

More information about the Snort-users mailing list